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Abstract 

A formula for the capacity of a quantum channel for transmitting private classical infor- 
mation is derived. This is shown to be equal to the capacity of the channel for generating 
a secret key, and neither capacity is enhanced by forward public classical communication. 
Motivated by the work of Schumacher and Westmoreland on quantum privacy and quantum 
coherence, parallels between private classical information and quantum information are ex- 
ploited to obtain an expression for the capacity of a quantum channel for generating pure 
bipartite entanglement. The latter implies a new proof of the quantum channel coding the- 
orem and a simple proof of the converse. The coherent information plays a role in all of the 
above mentioned capacities. 

Keywords: Cryptography, entanglement, large deviations, quantum channel capacity, wire- 
tap channels. 

1 Introduction 

The correspondence between secret classical information and quantum information, after having 
been part of quantum information folklore for many years, was first explicitly studied by Collins 
and Popescu |14|. The simplest example of this relationship is the ability to convert a maximally 
entangled Bell state |$ + ) = ^j(|0)|0) + |1)|1)) shared by Alice and Bob into a secret classical key 
by local bilateral measurements in the {|0),|1)} basis. Since the initial state is pure and hence 
decoupled from the "environment" , so is the information about the measurement outcomes. The 
converse direction does not hold in the literal sense: there is no way to recover the entanglement 
once the measurement has been made. However, given a quantum resource such as a quantum 
channel, it is conceivable that a secret key generating protocol could be converted into a (pure) 
entanglement generating protocol by performing all the steps "coherently" e.g. replacing proba- 
bilistic mixtures by quantum superpositions. The connection has been exploited in one direction by 
Shor and Preskill [35| in proving the secrecy of the BB84 quantum key distribution protocol by 
reduction from the entanglement-based protocol of Lo and Chau [2E| via Calderbank-Shor-Steane 
(CSS) J3| codes. In a different context, an equivalence has recently been established between 
the noise thresholds for certain two-way protocols for secret key distillation and entanglement 
distillation [T1ITT]. 

The motivation for the present work is a paper by Schumacher and Westmoreland in 
which an information theoretical approach to secret key generation is taken. They invoke standard 
classical results on wire-tap channels ^2 H61 El E3 to argue heuristically that the capacity of a 
noisy quantum channel J\f for generating a secret key should be lower bounded by the coherent 
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supported in part by the NSA under the US Army Research Office (ARO), grant numbers DAAG55-98-C-0041 and 
DAAD19-01-1-06. 
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information I c (p,J\f) |301 I26| of the channel with respect to an arbitrary input density operator p. 
Our first main result is an exact expression for the channel capacity for secret key generation K(J\f). 
At the time of writing j-'ilj it was only conjectured that the coherent information played a role in 
the quantum capacity Q{Af). The quantum capacity theorem was originally stated by Lloyd |2fi| . 
who also provided heuristic arguments for its validity. Other relevant early works include [501131 H|. 
It is only recently that a rigorous direct coding theorem has been reported by Shor (2! attaining 
the coherent information based upper bound of [5J 0] . Our second main result is a new proof of 
the direct coding theorem via an entanglement generation protocol based, in turn, on our secret 
key generation protocol. Shor's proof [S] is based on random subspace codes (see also Our 
code turns out to be related to a generalization of CSS codes, which is not surprising given its 
cryptographic origin. In addition we provide a new, simplified proof of the converse theorem of @], 
avoiding difficulties with restricting the encoding to partial isometries. 

It is necessary to introduce some notation for dealing with classical-quantum resources 
Classical-quantum resources can be static or dynamic. A static bipartite classical-quantum re- 
source, denoted by {cq\, is described by an ensemble E — {p x ,p{x)}. If the indices x £ X and 
distribution p are associated with some random variable X, and the density operators p~ = p x 
with some quantum system Q, the ensemble E may be equated with the classical- quantum system 
XQ. One may similarly have multipartite systems such as UXQ (of the {ccq} type) and XQ£ 
(of the {cqq} type) with more than one classical or quantum component. 

A dynamic bipartite classical-quantum resource, denoted by {c — > q] is given by a classical- 
quantum channel W : x \— > p x , or, alternatively, by the quantum alphabet {p x }. Analogous to the 
static case, the channel W may be equated with the conditional quantum system Q\X. Indeed, 
p~? is the state of the quantum system Q conditioned on the classical index being x. Dynamic 
resources are similarly extended to more than two parties. 

A useful representation of static classical-quantum systems, which we refer to as the "enlarged 
Hilbert space" (EHS) representation, is obtained by embedding the classical random variables into 
quantum systems. For instance, our ensemble E corresponds to the density operator 

P aq = J2p(x)\x)(x\ A ®P%, (1) 

x 

where A is a dummy quantum system and {\x) : x £ X} is an orthonormal basis for the Hilbert 
space of A. A static classical-quantum system may, therefore, be viewed as a special case of 
a quantum one. The EHS representation is convenient for defining various information theoretical 
quantities for classical-quantum systems. The von Neumann entropy of a quantum system A with 
density operator p A is defined as H(A) — — Ty p A logp A . For a bipartite quantum system AB 
define the conditional von Neumann entropy 

H(B\A) = H(AB) - H(A), 

and quantum mutual information 

I{A; B) = H(A) + H{B) - H(AB) = H{B) - H(B\A), 

in formal analogy with the classical definitions. For a tripartite quantum system ABC define the 
quantum conditional mutual information 

I(A; B\C) = H{A\C) + H{B\C) - H(AB\C) = H{AC) + H{BC) - H(ABC) - H{C). 

A commonly used identity is the chain rule 

I(A; BC) = I(A; B) + I(A;C\B). 

Notice that for classical-quantum correlations Q the von Neumann entropy H(A) is just the 
Shannon entropy H(X) = — J2 x p( x ) 1°8 p( x ) °f X. The conditional entropy H(Q\X) is defined as 
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H(Q\A) and equals ^2 x p{x)H(p x ). Similarly, the mutual information between X and Q is defined 
as I{X; Q) = I(A; Q). Notice that this is precisely the familiar Holevo information °f the 
ensemble E: 



Finally we need to introduce a classical-quantum analogue of a Markov chain. A classical Markov 
chain T — > X — > Y consists of correlated random variables T, X and Y whose probabilities obey 
Pr{Y = y|X = x, T = t} = Pr{Y = y\X = x}, which is to say that Y depends on T only through 
X. Analogously we may define a classical-quantum Markov chain T — > X — ► Q associated with an 
ensemble {pt x ,p(t, x)} for which p ta; = p^. Such an object typically comes about by augmenting the 
system X Q by the random variable T (classically) correlated with X via a conditional distribution 
Q(t\x) — Pr{T = t\X = x}. In the EHS representation this corresponds to the state 



We shall henceforth make liberal use of the concepts defined above and their natural extensions. 

The paper is organized as follows. In section 2 we define and find expressions for the private 
information and key generation capacities C V (W) and K(W), respectively, of a {c — > qq} type 
channel W. We show that allowing a free forward public channel does not help in either case. 
In section 3 these findings are applied to a noisy quantum channel Af setting, yielding analogous 
capacities C p (Af) and K(Af). In section 4 we turn to the problem of entanglement generation 
over the quantum channel N and find the corresponding capacity E(M). This result is readily 
translated into an expression for the quantum capacity Q{Af) in section 5. We conclude with open 
problems. 

2 Private information transmission and key generation over 
classical-quantum channels 

We begin by defining a general private information transmission protocol for a {c — > qq} channel 
from Alice to Bob and Eve. The channel is defined by the map W : x — > P x £ , with x £ X and 
the pQ £ defined on a bipartite quantum system Q£; Bob has access to Q and Eve has access to 
£. Alice's task is to convey, by some large number n uses of the channel W and unlimited use 
of a public channel (which both Bob and Eve have access to), one of 2 nR equiprobable messages 
to Bob so that he can identify the message with high probability while at the same time Eve 
receives almost no information about the message. The inputs to the composite channel W® n are 
classical sequences of the form x% . . . x n G X n , for which we use the shorthand notation x n (not to 
be confused with the power operation). The ouputs of W® n are density operators living on some 
Hilbert space Q n £ n . We formally define an (n,e) private channel code of rate R in the following 
way. Alice generates a random variable M which she can use for randomization, if necessary. 
Given the classical message embodied in the random variable K uniformly distributed on the set 
[2 nR ] := {1,2,..., 2 nR }, she sends the random variable X n = X n (K, M) over the channel W® n 
and sends the random variable S — S(K, M) through the public channel. Bob performs a decoding 
POVM (based on the information contained in S) on his system Q n , yielding the random variable 
Y, and computes his best estimate of Alice's message L = L(Y, S). We require 
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I(K;£ n \S) 
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The second condition means that the public information 5* is almost uncorrelated with K and the 
third implies via the Holevo bound |22j that, given the public information, there is no measurement 
Eve could perform that would reveal more than e bits of information about K 1 . We call the rate 
R achievable if for every e, S > and sufficiently large n there exists an (n, e) code of rate R — S. 
The private channel capacity C P (W) is the supremum of achievable rates R. 

The above scenario should be contrasted with a secret key generation protocol, where Alice 
does not care about transmitting a particular message but only about establishing secret classical 
correlations with Bob, about which Eve has arbitrarily little information. The definition of an 
(n, e) key generation code is almost the same as that of a private channel code, with the difference 
that now K itself is a function of M. The secret key capacity K(W) is similarly given by the 
supremum of achievable rates R. 

Theorem 1 



where Q£\X is given by W and T — > X 1 — > Q} £ l is a Markov chain. 

Note that the limit in equation JHJ) indeed exists, by standard arguments (see e.g. jS], Appendix 
A). It should be noted that the above formula does not quite attain the ultimate goal of being 
effectively computable, due to the / — > oo limit. This seems to be a ubiquitous problem in quantum 
information theory, and we shall encounter it two more times in this paper, namely, in theorem [S] 
and proposition 

Proving that the right hand side of © is achievable is called the direct coding theorem, whereas 
showing that it is an upper bound is called the converse. It is obvious from our definition that 
K(W) > C P (W), since any private channel can be used for generating a secret key. Hence it 
suffices to prove the converse for K(W) and achievability for C P (W). 

Proof of Theorem ^ (converse) We shall prove that, for any 6, e > and sufficiently large 
n, if an (n, e) secret key generation code has rate R then 



Cp(W) = K(W) 




(6) 



fl-£<-max{/(T; Q n )-I(T- £ n )}. 



The proof parallels the classical one from |2] . Fano's inequality JS] says 



H(K\L) < 1 + ¥r{K ^ L}nR. 



Hence 



nR 



< 



H(K) 

I(K;L)+H(K\L) 
I(K;L) + l + nelog\X\. 



The last inequality follows from condition |JS}. Furthermore, 



I(K;L) < I(K;SQ n ) 



= I(K;S) + I(K;Q n \S) 

< I{K-Q n \S)~ I{K-£ n \S) + 2e 

= I{T;Q n \S)-I(T;£ n \S)+2e, 



(7) 



As we shall see, e can be made to decrease exponentially in n. 
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where T — KS. The first inequality is a consequence of the Holevo bound J22I an d the second 
inequality follows from conditions |@J and ©■ Since, without loss of generality, e < 61o g | ;y| and 

"> I 

-[I(T-Q n \S)-I{T;£ n \S)]>R-5, (8) 
n 

with S — > T — > X™ — * Q n £ n a Markov chain. Since the left hand side can be written as the average 
of 

i[/(T s ;fi?)-/(T s ;£ s ")] (9) 

with respect to the distribution of S, and the Markov condition T s — > X™ — > f ™ holds for each 
s, choosing the particular value of s that maximizes (0 proves the claim.H 

For the direct coding theorem we shall need two lemmas. The first is a quantum version of the 
Chernoff bound from [2] . 

Lemma 2 (Ahlswede, Winter) Let£i, . .. ,£„ be independent identically distributed (i.i.d.) ran- 
dom variables with values in the algebra B(7i) of bounded linear operators on some Hilbert space 
Ti., which are bounded between and the identity operator I . Assume that the expectation value 
E£ m = 6>tl. Then for every < t) < 1/2 

Pr<! - > ' U <£ [(1±t?)0] }< 2dimHcxpf-/i- ?? ' 



rji££ ro £[(l±7?)0]j 
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where [(1 ± n)8] = [(1 — rj)9; (1 + rj)6] is an interval in the operator order: [A; B] = {£ S B(7i) : 
.1 • i • /)'|. ■ 

The second lemma is Winter's "gentle operator" lemma [HZ). It savs that a POVM element 
that succeeds on a state with high probability does not disturb it much. 

Lemma 3 (Winter) For a state p and operator < A < / ; if Tr (pA) > 1 — A, then 

p - VXpVX ^ < V8X. 
The same holds if p is only a subnormalized density operator. ■ 

In the above, = Tr V AA^ denotes the trace norm of some operator A. It is a norm in 

the sense that the trace distance between two operators A and B, \\A — B\\\, satisfies the triangle 
inequality 

\\A-C\\i<\\A-B\\i + \\B-C\\i. (10) 

Proof of Theorem ^ (direct coding theorem) We shall construct a private channel code 
that achieves the expression @ without making use of the public channel from Alice to Bob. 
Consequently, the public channel cannot increase C P (W) or K(W). Fixing the random variable X 
with distribution p, our goal is first to show that a private information rate of I(X; Q) — I(X; £) is 
achievable. We shall draw heavily on ideas from Winter's POVM compression paper Define 
a x = Tr q(p~? £ ) and uo x = Trs(p^ £ ), the local alphabets for Eve and Bob, respectively, and let 

In what follows we shall assume familiarity with the notions of typical sets Tj^ s , typical sub- 
spaces Wg s and conditionally typical subspaces g(x n )- These are defined in Appendix A for 
convenience. 
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Fixing S > 0, we have the following properties (for x n £ Tjf s , where applicable) |3"?ll§] 



„ ._ p..r v' n <= T™ -l- 


> 


1 _ P 


C1 1 1 


Tr^ng |X)5 (or«) 


> 


1 - e 


(12) 


Tr(T x nII £) jQ^| +1 j 


> 


1 - e 


(13) 


Tr^nn™ |x>5 (ar") 


> 


1 - e 


(14) 


Trw^IIgjpi^) 


> 


1 - e 


(15) 


Tr 5(1^-1+1) 


< 


a" 1 


(16) 


n£|x,s(z™K»ng |X) ,Or™) 


< 




(17) 


TrH£ |x >") 


< 




(18) 


-rrn ,®n.TTn 
11 C,5(|A'| + 1) W n Q,<5(|*| + l) 


< 


an Q,5(|^|+i)- 


(19) 


o = 2 -„[ff(£|X)-c*] j s = 


2 -n 


[ff(Q)-c<5] j p _ 


2 -n[H(Q\X)+eS] for gome 



Here a = 2~ n ^^> + 
constant c and e = 2~™ c 5 for some constant d . Define, for x n £ T£ s , 

pi _ jrn HI TT™ 

Cx™ — ll e,s(\x\+i)^x nll e,s(\x\+i)- 
Since cr^n commutes with 11^,^ §(x n ), < a x n. From this, i|12|) and (|13fl 

Tr^„ = TrC,-Tr(/-n^ 5(|A , |+1) )C. 
> 1 - 2e. 

Let p' be the "pruned distribution p®" with respect to the set T£ s , namely 

p'(x n ) = 1 ' X fc Ix > s 
I otherwise, 

where s is as defined in I jllj l. Then Tr8' > 1 — 2e, for 

Let II be the projector onto the subspace spanned by the eigenvectors of 9' with eigenvalue > ea. 
By 11161 . the support of 0' has dimension < a" 1 , so eigenvalues smaller than ea contribute at most 
e to Tr(9'. Hence, Tr0 > 1 - 3e for 6 = WR. Also let £,.» = H^„n, p! = 2™[ / ( x ^)+ 3 ( c + c '- 5 )' 5 ] , 
K i _ 2 n[7(X;Q)-J(X;e)-5(c+c'«)«] and define j j d random variables U km , m £ [//], k £ [k'\, each 
distributed according to p' . Observe that 8 — E£j/ fcm , where E denotes taking expectation values 
with respect to the distribution p' . Define the event 



it' ^ 

r m=l 



According to lemma |3 



Pr{not L k } < 2Trn exp ( J , V*. 



e 3 a 



The right hand side, being a double exponential in n, can be made < en' 1 for all k and sufficiently 
large n. Now we shall argue that {Ukm is a good code for the {c — > q} channel Q\X [37] with high 
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probability. It is a random code of size 2™[ / ( X;S ) _2 ( c + c and each codeword is chosen according 
to the pruned distribution p' . The proof of the Holevo-Schumacher- Westmoreland theorem |2"3~] 
involves choosing codewords according to the distribution p® n and can be easily modified to work 
for p' (see Appendix B). Consequently the expectation of the average probability of error can be 
made to decay exponentially with n: 



Define the event 



Ep e ({t/ fem }) < lOe. 



t = \pe{{U km }) < V 7 ^} 



(21) 



Then Markov's lemma (from standard probability theory), according to which for any random 
variable X and constant 7 > 

Vr{X > 7EX} < 7 _l , 



implies 

By construction, 



Pr{not l } < lOtfe. 



Pr{not(/,o & I'l 



(22) 



fc=0 



so there exists a particular value {uk m } of {U km \, for which holds for all k = 0, . . . , k' (in fact, 
we have shown this holds with probability > 1 — e — for a randomly chosen {uk m })- For all 

x n e T^xs we nave j by lemma |3 



(23) 



Now, Lk implies 



Tr 



> 1 - 4e 



and hence, by l(23|) and lemma E3 



1 

7 5 ^ 



A* 

< (e + \/l6e) + \/327 + e = 2e + + 4-\/2e. 



1 M 

77 ^ Ufc 



1 

(24) 



So far we only have a bound on the average error probability for the channel code. We would 
like each individual codeword to have low error probability. By 1)21(1 . at most a fraction yfi of the 
codewords u^m have error probability > yfk. Moreover, at most a fraction ffi of the values of k 
are such that a fraction > sfi of the Uk m for that particular k have error probability > We 
shall expurgate these values of k from the code, without loss of generality retaining the set [k] with 
K = (1 — tfe) k' . For each k <E [as], order the Ukm according to increasing error probability, and 
retain only the first fi — (1 — ^fe) // of them. This slight reduction in k' and \j! now ensures that 
each codeword has error probability < ^/e. Since 



1 M 1 M 



(25) 
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we now have 



1 M 

1 E 

A* i 



< 2e + 4Ve + 4\/2e + 2^ =: e'. 



(26) 



Note that this expurgation ensures that all the Uf. m are distinct; if they were not, the probability 
of error for a repeated codeword would be > i, a contradiction for sufficiently large n. Defining 



and 



we have 



1 

^ m=l 
1 " 

o 7 = - cr k 



fe=l 



Ikfe < 2e', Vfc. 

By Fannes' inequality (see e.g. |2U) we can estimate 



(27) 
(28) 



k=l 



< rj(2e') + 2ne' log dim H £ , 



(29) 



when 2e' < - and where r)(x) = — xlogx. We are now in a position to describe our private 
channel code. The random variable M is uniformly distributed on \p\, the message K is uniformly 
distributed on [k] and the channel input is X(K,M) = ukm- By construction, Bob can perform a 
measurement that correctly identifies the pair (fc, to), and hence k, with probability > 1 — ^fe. The 
rate of the code is bounded as R > I(X; Q) — I(X; £) — 6(c+c'5)S, for sufficiently large n. Equation 
lEU and e = 2~ c ' n ensures that I(K; £ n ) can be made arbitrarily small (indeed exponentially small 
in n) for sufficiently large n. Notice that by simulating some channel X\T in her lab, Alice can 
effectively produce the Q£\T channel for T — > X — > Q£; thus J(T; Q) — J(T; 5) is also achievable. 
The multi-letter formula © follows from applying the above to the super- channel W m . U 

Remark The classical analogue of theorem^ namely the capacity C P (W) of a {c — * cc} channel 
W — Y Z\X was first discovered in |41l for a weaker notion of secrecy, and later strengthened 
in |27| . Our result implies a new proof of the classical direct coding theorem, using large deviation 
techniques instead of hashing/extractors as in the work of Maurer and collaborators |27j. 



3 Private information transmission and key generation over 
quantum channels 

Now we shall apply these results to the setting where Alice and Bob are connected via a noisy 
quantum channel N : B(H-p) — * B(Hq). Here B(Tt-p) denotes the space of bounded linear 
operators on Ti-p, the Hilbert space of the quantum system V . The channel Af is (non- uniquely) 
defined in terms of the operation elements {Ai}, J2i A\Ai = /, as 

M{p) = Y J ^ P A\. 

i 

This representation is exploited in Shor's proof of the quantum channel capacity theorem |34j. 
Here we take a different approach to noisy channels, propagated by Schumacher and collaborators 
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POllS]- The channel is physically realized by an isometry C/v : B(H-p) — > B(Ti.Qs), called an 
isometric extension of J\f, which explicitly includes the unobserved environment E. 2 

We shall assume that the environment £ is completely under the control of the eavesdropper 
Eve, and the quantum system Q is under Bob's control. Suppose Alice's initial density operator is 
given by p v . Defining u Q = Af(p v ) — Tr£Ujij(p v ) and a £ = TrQUj^(p v ), the coherent information 
is defined as 

I c (p v ,Af)=H(Lu Q )-H(a £ ). 

Note that, although there is an infinite family of U_\f corresponding to a given TV, the coherent 
information is independent of this choice |3()| . Since we are interested in transmitting private 
classical information, the most general protocol requires Alice to prepend a {c — > q} channel V\X 
of her choice (given by some alphabet {p x } £ V 3 ) to j instances of A/", for arbitrarily large j. This 
induces a {c — > qq} channel QPS^X, and we may now apply the results of the previous section. 
Combining the I — > oo limit from equation JJjJ with the j — > oo one and absorbing T into X gives 

C P {N) = K(N) = lim y max{/(A; Q l ) - I(X;£ 1 )}. 

It is easily verified (see also section 4) that this may be rewritten as 

CJN) = A (A") = lim ~ max Up,Af® 1 ), (30) 
i^oo / pen® 1 

where we introduce the private information I p : 

I p (p,Af) = I c (pM) ~ f min J J2p(x)Ic( Px ,M) : ^p^)^ = p \ . (31) 

The above expression for K{N) is almost implicit in [2], albeit without proof. Note that I p {p,J\f) > 
I c (p, A/") since any decomposition of p into pure states sets the expression minimized in ()31(l to zero. 
It is codes corresponding to I p {p,M) = I c {p,J\f) that will be relevant for entanglement generation. 
In Appendix C we give an example illustrating the possibility of I p > I c > 0. 



4 Entanglement generation over quantum channels 

In this section we apply the above results to the more difficult problem of entanglement generation 
over quantum channels. The objective is for Alice and Bob to share a nearly maximally entangled 
state on a 2 nR x 2 nR dimensional Hilbert space, by using a large number n instances of the noisy 
quantum channel A". Before getting into details we should recall some facts about fidelities and 
purifications (mostly taken from |28p. The fidelity of two density operators with respect to each 
other can be defined as 3 

F(p,a) = \\^\\l 
For two pure states |x), \Q this amounts to 

F(\x), 10) = KxlOI 2 - 

2 The standard formulation of 1301 refers to a channel J\f : B(Hq) — * B(Wq) with the same input and output 
Hilbert space. The channel is physically realized by appending an environment system £, wlog initially in a pure 
state, applying a unitary operation U £ ® on the joint system, and tracing out £. Here we adapt the slightly more 
general approach of |I] in which the input and output Hilbert space of the channel may differ. 

3 Our definition of fidelity is the square of the quantity denned in 1281 . 
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Lemma 4 Consider two collections of orthonormal states {\Xj))je[N] an d i\(j))je[N] such that 
(XjKj) > 1 ^ e f or all 3- There exist phases 7j and 5j such that 

(X|C> > 1 - e, 

where 

l*> = ^E e ' 7i l%). ( 32 ) 

id 



.7=1 

N 



-^E^IO- (33) 

.7 = 1 



Proof Define the Fourier transformed states 

N 

1 



and similarly define |£ s ). It is easy to see that 

S=l J=l 

hence at least one value of s obeys 

e w '<X.|6>>l-e, 

for some phase 6 S . Setting 7^ = 2-xjs/N and <5j = 7j + 9 S satisfies the statement of the lemma. 
Moreover, a fraction 1 — yfi of the values of s satisfy 

e^(x s |6)>l-V^, 

a fact we shall use in Appendix D. ■ 

The following relation between fidelity and the trace distance will be needed: 

l-y/F(p,a) < — o-||i < y/1 -F(p,a), (34) 

the second inequality becoming an equality for pure states. A purification \& P )' R '® of a den- 
sity operator is some pure state living in an augmented quantum system TZQ such that 
Tr n ( I $p)($ p I S ) = p Q . Any two purifications |$ P ) KS and |$ p ) KS of p Q are related by some 
local unitary U on the reference system 1Z 

W P ) UQ = (u n ®i Q )\$> p ) nQ . 

A theorem by Uhlmann states that, for a fixed purification & a of a, 

F(p,a)=maxF(\$ p ), 

A corollary of this theorem is the monotonicity property of fidelity 

F(p lzQ ,a llQ )<F(p Q ,a Q ), 
where p Q = Tr K p nQ and a Q = Tr K a nQ . 
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Returning to the problem of entanglement generation, an (n, e) code is denned as follows. Alice 
prepares, without loss of generality, a pure bipartite state \T) AV in her lab, defined on Ha^'H^ 71 , 
dim7i^ = K , and sends the V n portion of it through the channel. Bob performs a general decoding 
quantum operation on the channel output T> : B(Ti.Q n ) — > B(Hb), dim7ig — n, yielding the state 

n AB = [i A ® (VoN® n )}{\r)(r\ Avn ). (35) 

The rate of the code is R = ^ log k. We require 

F(\<?> K ) AB ,n AB ) > l-e, 

where 

- J\jl\k) A \kf 

k=l 

is the standard maximally entangled state shared by Alice and Bob. We shall call a rate R 
achievable if for every e, 5 > and sufficiently large n there exists an (n, e) code of rate R — 5. The 
entanglement generating capacity E(Af) is given by the supremum of achievable R. 

Theorem 5 Given the channel Af, 

E(M) = lim - max I^p^N® 1 ). (36) 

Remark Note that K{M) > E(N) is obvious since any pure entanglement can be converted into 
a secret key by performing a measurement in the {\k)} basis. It is not clear from formulas (|30|l 
and (|36|l whether the inequality can be made strict. We return to this issue in the final section. 

The converse theorem makes use of the following simple lemma 0]. 
Lemma 6 For two states and cr 7 ^ of a quantum system 1ZQ of dimension d with fidelity 

\AH(p KQ )-AH{a KQ )\ < -+41ogd v /l _ 7. 

e 

where 

AH{p nQ ) = H{p Q )-H(p nQ ). 

Proof By the monotonicity of fidelity, F(p B ,a B ) > /. The lemma follows from a double 
application of Fannes' inequality [2E] and l|34(l . 

Proof of Theorem |S| (converse) We shall prove that, for any 5, e > and sufficiently large 
n, if an (n, e) code has rate R then R — S < ^I c (p,Af® n ), where p the restriction of |T) to H® n . 
Evidently, it suffices to prove this for e < [ 16 i J imT j ? ] 2 and n > The converse relies on the 
quantum data processing inequality, which says that quantum post-processing cannot increase the 
coherent information |3(J| . 

I c {p,M® n ) > I c {p,VoM® n ) 
= AH(Q) 

> Ai/(|$ K )($ K |) - - - 8ni?V^ 

e 

2 r 

> nR 8nlogdim7ipve, 

e 

from which the claim follows. The first inequality is the data processing inequality and the second 
inequality is an application of lemma M 
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Proof of Theorem [5] (direct coding theorem) It suffices to demonstrate that a rate of 
I c (p,Af) is achievable for any p £ Ti-p- The regularized formula (|36|1 is obtained by additional 
blocking. Following |31| . consider the eigen-decomposition of p into the orthonormal pure state 
ensemble {p(x), \tj> x )}, 

5>(x)|^W s |=/>. (37) 

X 

The distribution p defines a random variable X. Let Ujj : B{TL-p) — > B{TLQg) be an isometric 
extension of Af. Define the {c — > qq] channel W : x \— > Uj^\4> x ) v —: \4>' X ) Q£ ■ Define the local output 
density matrices seen by Bob and Eve by ujf = Tr £ (|^)(^| S£ ) and erf = Tr Q (|</4) (<f>' x \ Q£ ), 
respectively, and the averages over ibyw 9 and a £ , respectively. In section 2 we showed that for 
any S there exists an (n, e) code, defined by {uk m ■ k £ [k], m £ [p]}, of rate ^ log K = I c (p,JV) — S. 
Indeed [3T] 

I(X;Q)-I(X;£) = H («;<*) - 5>(*)IT(a£) - H(a s ) +^(^(4) 

X X 

= H{cu Q )-H{a £ ) 
= J (P,</V), 

since H{u)%) = H(a £ ) for all x. 

In what follows we shall be dealing with blocks of length n and use the abbreviated notation 
Q for Q n , etc. Consider sending the state \4>km) V '■= \ < Pu km ) V through the isometric extension 
channelC/^™ 

W k J Q£ = uT\<t> km ) p - 

Define a £ m = Tr Q (|0' fcm )(0' fem | S£ ) and 

m 

As shown in section 2, there exists a 9 £ such that, for all k, 



< e. (38) 



In addition, there is a measurement Bob can perform on Q that with probability > 1 — e correctly 
identifies the index km. Since any measurement can be written as a unitary operation on a 
larger Hilbert space (including some ancilla initially in a pure state) followed by a von Neumann 
measurement on the ancilla, there exists a unitary V QBB such that 

(i £ ^v^'M' km ) Q£ \of\of = \^ m ) Q£m ' 

and 

F(p^,\k) B \mf)>l-e, 

for p BB n = ^Qe(\ipkm}(^Pkm\ Q£BB )• By Uhlmann's theorem, for the purification \ipkm} Q£13B of 
Pkm there exists a "purification" \xkm) Q£ \k) B \m) B of \k) B \m) B such that 

(ipkm\ Q£BB '\Xk m ) Q£ \k) B \m) B ' > 1 - e. (39) 

Let 4 m = Tr Q(IXfcm)(Xfcm| S£ ). Since | f/'fcm) Q£BB ' is also a purification of of m , we have, by (HI}, 
the monotonicity of fidelity and lj3*§|l : 



! < 2J1-F(a £ a £ ) 



< 2Jl - F{\i> km )Q £BB ' , \ X km) Q£ \k) B \m) B ') < 2V~e. 
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Define 



Then 



wn-o £ h < -T,\\ (j t l -^ m \\i + h £ k ~0 £ \\i (4i) 

^ m 

< 2^/i + e. (42) 

By 

F(?£,0 £ )>l-2Vi-e. (43) 
Consider the set of quantum codewords {\4>k}}'- 

ed. . 

and applying V QBB ' , becomes 



with the phases 7^ m to be specified. After transmission through Uff 71 , adding the ancilla |0) e |0) 8 



m &£BB' = JlY.^ km \^) Q£m ' ■ (45) 

rn 

By (|39[) and lemma [3] we can choose the phases jkm and 5km so that 

(^| S£66 >) e |^) Q£8 '>l-^ (46) 

where 

\<Pk) 

Note that erf = Trgg'(|v5 fc )(^ fe | ), as defined in |@UJ|. Hence, fixing a purification |<I>e) S£e ' of 
£ , for all k £ [k] there exists a unitary J7^ B such that (cf. |32j) 

(<& e | Q£e 'K SB ' ® / £ ]|^) S£6 ' > 1 - 2^- e, 
by applying Uhlmann's theorem to l|43|l . Introducing the "controlled" unitary 

tf BSB '=£|fc)<fc| B ®tff B ', 

fc 

the above may be rewritten as 

^o\ Q£B '(k\ B [U BQB ' ® / s ]|fc) B |^) SfB ' > 1 - 2Vi- e. 
Combining this with ffify gives 

($ e | S£e '(fc| 8 [C/ 8se ' ® I £ ]|^) S£88 ' > 1 - 4x/i- 4e. (47) 
We can now define our entanglement generating code. Alice prepares the state 



V M 



|t>^ = ^£i*>"V*> 



(48) 



13 



keeps the system A and sends the system V through the channel. Bob subsequently applies the 
decoding operator 



T> : en® i — ► Tr 



QB' 



-jjBQB'yQBB'^Q g |Q) <0| B ® |0) (0| 8 > SOT ' V^' f ] , (49) 

resulting in some state which by l|47|l and the monotonicity of fidelity obeys 

F{n AB ,\<5> K ) AB ) > l-4Vi-4e. (50) 
This concludes the proof of the direct coding theorem. ■ 

Remark Transforming a private channel code into an entanglement generating one appears to 
work only for pure state decompositions of p. Otherwise, the pure states \<j)') become effectively 
shared by Alice, Bob and Eve. The decoding operation T> would then involve performing joint 
operations on spatially separated quantum systems belonging to Bob and Alice, which cannot be 
accomplished in general without additional quantum resources. 

Remark Note the similarity between 144|) and CSS codes ^3]. Indeed, here we have a coset- 
like decomposition of a {c — > q} "error correction" code of size up into k {c — > q} "privacy 
amplification" codes of size p, (see j2U for a nice exposition of these concepts in the context of 
the Shor-Preskill result 35 ). The differences lie in that CSS codes have an additional algebraic 
structure and are composed of purely classical rather than classical-quantum codes. 



5 Quantum information transmission over quantum chan- 
nels. 

Finally we arrive at our destination: recovering the formula for the quantum capacity Q(J\f) of a 
quantum channel A/". This quantity has been rigorously defined in 0] and we briefly review it here. 
An (n, e) code is defined by an encoding operation £ : B(H.) — ► B(7i|J™) and a decoding operation 
V : B(H% n ) — ► B(H), such that 

min F{\(t)),(VoAf <g > n o£)(\ ( j))((j)\))>l-e. (51) 
\<t>)en 

The rate of the code is given by R — — log dim H. The quantum capacity of the channel Q{M) is 
the supremum of all achievable R. 

There is an alternative definition, in which the condition l|51|l and the definition of R are 
replaced by 

i? = max{ J ff(p) : F e (p, V o N® n o £) > 1 - e}. (52) 
Here F e is the entanglement fidelity I28| 

F e (p,0) = F(|*),(J(giO)(|*)(*|)) ) 

where I'S) is some purification of p (F e is independent of the particular choice of 1^)). We denote 
the corresponding capacity by Q(JV). In 4 , Q(Af) and Q(Af) were called the subspace transmission 
and entanglement transmission capacities of the channel, respectively, and were shown to be equal. 

It comes as no surprise that entanglement generation and entanglement transmission are closely 
related. This intuition is made rigorous by the following proposition. 

Proposition 7 Given the channel AT, 

Q{N) = Q{N) - Eihf) = lim - max I c {p,M® 1 ). (53) 
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Proof It is obvious that E(Af) > Q(Af), since the quantum channel may be used to transmit half 
of a maximally entangled state. Notice that this fact in conjunction with the converse for theorem 
yields a new and substantially simpler proof of the converse to the quantum channel capacity 
theorem (cf. 0]). To prove that E(M) < Q(Af) requires just a bit more work. In |10ll4*| it was shown 
that Q^(Af) = Q(Af), where Q—>(J\f) is the quantum capacity of a quantum channel Af enhanced 
by unlimited forward classical communication (cf. our corresponding result for private information 
transmission). Defining E->(Af) analogously it now suffices to show E^(AT) < Q_>(A/"). Indeed, 
any entanglement generated may be used in conjunction with the forward classical channel to 
perform quantum teleportation of the state p [5]. More precisely (see section 4), Alice and Bob 
generate the state ft satisfying 

/ = F(|$ K ),Q)>l-e. 
They may perform a bilateral twirling operation |l(Jj to transform f2 into a Werner state 

T(Q) = f dU(U®U*)Sl(U®U*)i = /|$ K )($ K | + ^—4(1- 

J K— 1 

which is now interpreted as being in the state |$ K ) with probability /. Since teleporting a state p 
living in a K-dimensional Hilbert space H. via the maximally entangled |$ K ) yields an entanglement 
fidelity of 1, using T(Q) instead will give an entanglement fidelity of at least / > 1 — e. Actually, 
one need not perform the full twirling operation. The twirl is equivalent to applying some bilateral 
U <£> U* chosen at random. Thus there exists a particular value of U for which the entanglement 
fidelity is > /. Furthermore, the U ® U* is easily absorbed into |T) and V of the entanglement 
generating protocol. Choosing p to be maximally entropic proves the claim. Thus Q{N~) — E(Af). 
U 

Remark It is possible to modify the proof of the direct coding part of theorem [S] to lower bound 
Q(Af) directly rather than via E(Af). This is done in Appendix D, where we also show the existence 
of random entanglement transmission codes of large blocklength n with rate arbitrarily close to 
I c (p,Af) and the nice property that the average density operator of the codewords is arbitrarily 
close to p® n . 



6 Discussion 

We have defined and found expressions for the private information transmission C p and secret key 
generation K capacities for classical-quantum wire-tap channels W and quantum channels J\f. A 
subclass of the corresponding protocols was made "coherent" to yield entanglement generation and 
quantum information transmission protocols achieving the respective capacities E(Af) and Q(J\f). 
Thus we have established a very important operational connection between quantum privacy and 
quantum coherence 

Our results show that C p (W) = K(W), C p {N) = K{N) and E{N) = Q{N). On the other 
hand, it is obvious operationally, as well as from I p (p,N) > I c (p,N), that K(Af) > E(M). Al- 
though it is easy to find examples of strict inequality between I c (p,Af) and I p (p,Af) for particular 
(p,fif) pairs (see Appendix C), it is not clear whether this still holds when optimized over p and 
in the asymptotic sense of H30|) and lj36|) . In particular, we would like to know whether there 
exist quantum channels which cannot be used for transmitting quantum information, yet may be 
used to establish a secret key. The "static" analogue of this question was answered recently in 
in |24j by providing an example of a bipartite state with non-zero distillable secret key but zero 
(two-way!) distillable entanglement. It is natural to expect that a channel related to this state 
would demonstrate a separation between K and E 36 . 

Another open problem is whether the formula for C P (W) may be single-letterized (as in the 
purely classical case JB]) for general channels or at least certain classes of channels. The same 
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question is open for C p (Af), whereas counterexamples are known for Q(Af) HOI- A non-trivial class 
of channels exists (so-called degradable channels) for which Q(AT) is efficiently computable |18j . 
and it can be shown that this property extends to C P (W) (we do not know this to be true for 
C P (J\T)). More generally, we would like to be able to say something about the convergence rate of 
the limits in equations l|3U|) and (|36fl . 

A natural extension of the present work would be to allow two-way public/classical communi- 
cation for key /entanglement generation. This enhanced auxiliary resource is known to improve the 
capacities in both cases E3 QUI > ^ seems unlikely that reasonable information-theoretical 
formulas exist in general. 

The results of section 2 were independently obtained by Cai and Yeung ^21 j see |391 HU| . 
Acknowledgments We thank C. H. Bennett and J. A. Smolin for useful discussions and the for- 
mer for pointing us to 55) . Thanks also go to A. W. Harrow, D. W. Leung, K. El-Zein and J. Yard 
for comments on the manuscript. Finally, we are indebted to A. S. Holevo and D. Kretschmann 
for drawing our attention to a couple of technical errors in an earlier version of the paper. 

A Definitions of typical sequences and subspaces 

We shall list definitions and properties of typical sequences and subspaces ^| EH EZj • Consider 
some general classical-quantum system UXQ in the state defined by the ensemble {p(u,x), p ux }. 
X is defined on the set X and U on the set U. Denote by p(x) and P(x\u) the distribution of X 
and conditional distribution of X\U, respectively. 

For the probability distribution p on the set X define the set of typical sequences (with 8 > 0) 

T p n s = {x n ■ Vx \N(x\x n ) - np{x)\ < n5} , 

where N(x\x n ) counts the number of occurrences of x in the word x n = x±...x n of length n. 
When the distribution p is associated with some random variable X we may use the notation T£ g ■ 
For the stochastic map P : hi — > X and u n € hi n define the set of conditionally typical sequences 
(with 5 > 0) by 

T£ 5 (u n ) = {x n : Mu,x \N((u, x)\(u n , x n )) - P{x\u)N(u\u n )\ < nS} . 

When the stochastic map P is associated with some conditional random variable X\U we may use 
the notation T™\ us {u n ). 

For a density operator p on a c?-dimensional Hilbert space Tl, with eigen-decomposition p = 
Sfe=i ^k\k)(k\ define (for 5 > 0) the typical projector as 

When the density operator p is associated with some quantum system Q we may use the notation 
For a collection of states p u , u £ U, and u n £ ti n define the conditionally typical projector as 

u 

where I u = {i : it, = u} and IF:" s denotes the typical projector of the density operator p u in the 
positions given by the set I u in the tensor product of n factors. When the {p u } are associated with 
some conditional classical-quantum system Q\U we may use the notation Tlg, us (u n ). 
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B The modified HSW theorem 

Define v — 2™[ / ( X;S )~ 2 ( c + c <5 ) <5 1 i.i.d. random variables {U s }, s € [v], according to the pruned 
distribution p' . We shall show that this random set can be made into a HSW code for the {c — ■> q} 
channel Q\X with low probability of error. More precisely, we shall construct a decoding POVM 
{Y s } such that 

Ep e ({U s }) = ETr(u Ua (I-Y s )) < lOe. 

We shall need the following lemma due to Hayashi and Nagaoka : For any operators < S < I 
and T > 

I-(S + T)-5S(S + T)~i < 2(1 -S) + AT. (54) 
The {Y s } are constructed as follows 

t i 

with 

h x n = ^Q } S(\x\ + l)^-Q\X,s( xn )^-Q, S(\X\ + 1)- 

Then, by (£>H, 

Pe({U s }) < 2(1 -Tcuv.hu,) + A^Txw Ua h Ut . (55) 

It is not hard to verify (cf. lemma 6 of [2]) that for x n G T£ s 

Trio x nh x n > 1 — 3e 

follows from H2} and JTHJ). By (JTHJ 

Trh x n < /T 1 . 

Also note that 

Ew v , = 5>'(z"H" < (! - e)- 1 "®", 

so that, by ljT§|) . 

^Q, <5(l^'l + l) Ea;i/ = n S,<5(|A'| + l) - (1 _ e ) 1( 5ng ; + 

Putting everything together, taking the expectation of (|55|l and noting that U s and Ut are inde- 
pendent for s y^t, we have 

Ep e ({C/ s }) < 6e + 4(i/-l)Tr(Ew C7s EA c/t ) 
< 6e + 4^(l - e^a/T 1 < lOe, 

the last inequality coming from our choice of v. 



C An example of I p (p,J\f) > I c (p,X) 

Consider a four dimensional Hilbert space O4, with orthonormal basis {|1), |2), |3), |4)}. Let II12 
be the projector onto the space spanned by |1) and |2), and let II34 be the projector onto the space 
spanned by |3) and |4). Our channel 4 M : B(TL/C) — ¥ 13(0.4) is given by 

Af( P ) = n 12/9 n 12 + 2? 3 4(iwn 34 ), 

4 This channel was suggested to us by J. A. Smolin. 
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where P34 is the completely depolarizing channel on the two dimensional subspace spanned by |3) 
and |4). Defining i\\2 = ^n 12 and ^34 = ^n 3 4, it is easily verified that 



Define, for some small positive e, 



/ c (^i2,A0 = 1 

/c(^34,A0 = -1. 
ll[ 2 = (1 - e)TTl2 + 67T34 

7T 3 4 = (1 — e)7T34 + «ri2. 



(56) 



(57) 



By continuity, for sufficiently small e 



Since 



/ C « 2 ,A0 > 

j c K 4 ,ao < 0. 



1 - e - e 2 , , , , 1 - e 



1>(1| + S 12>(2| + -|3)(3| + -|4)(4|, 



is a valid decomposition of ir' 12l it is readily seen that 



D The average density operator of random quantum codes 

In this section we show how to convert a subclass of the entanglement generation codes described 
in section 4 into entanglement transmission ones of the same rate I c (p,M) — S. Then we construct 
random entanglement transmission codes of the same rate such that the average density operator 
of the codewords becomes arbitrarily close to p® n for large enough blocklength n. 

Alice is given the system A', entangled with some reference system A she has no access to, in 
some general state with Schmidt decomposition 

|*)^' =J2a k \k) A \k) A ' . 

k 

Her goal is transfer the entanglement with A from her system A' to Bob's B. Notice that the states 
\4>km) V (and hence \4*k) V ) are mutually orthogonal. Consequently, there is an isometric encoding 
£ defined by \k) A 1— > \4>k) v which maps l^)^- 4 to 

\T) AV =^\k) A \^) V , (58) 

k 

now bearing a strong resemblance to l|48|l . By following through the remaining steps of the proof of 
theorem |S1 it is easily seen that after applying the decoding operation T> given by (|49|l one arrives 
at (c.f. P1Q: 

F(|*),(/®(I>oAr 8n of))(|*)(*|)) > l-4Vc-4e. (59) 

Choosing |\&) to be maximally entangled implies, via Q52JI. an achievable entropy rate of - logK = 
I C ( P ,JV)-S. 

The set S = {\4>k)} is sometimes referred to as the quantum code. A natural quantity to define 
is the quantum code density operator 
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i.e. the input to the channel J\[® n as seen by someone ignorant of the encoded state. Little can 
be said about p(S) for any particular quantum code S given by our construction. However if 
we consider random codes, a probabilistic mixture of deterministic codes given by an ensemble 
{pp,S@\, we can make the average code density operator 



be arbitrarily close to p® n . We shall show this via a double randomization of our original protocol. 
1. First recall that for fixed k and fixed set {|</>fc m )}me[Ai] > the kth quantum codeword (|44|l 



km / 



was chosen from one of p Fourier states. If they were all "e-good" quantum codewords, in the sense 
of 1|46[) . then picking \fa) a t random according to the uniform distribution on the set of Fourier 
states, for each k, would result in a random code with average code density operator 

P = \fam){fam\- 

According to the proof of lemma0J a fraction 1 — y/e of the Fourier states are ^/e-good codewords. 
The random code in which each \fa) is uniformly distributed over these -^/e-good codewords has 
an average code density operator p for which 



J2 I <t>km)(fa m 1 1| < 2 Ve- 



(60) 



(fe,m)e[K]x[/i] 



At the same time, equation <|59[1 must be modified to account for the codes being -^/i-good instead 
of e-good: 

F(|*),(/®(DoAr 8n of))(|*)(*|)) > l-6\/e-2e. (61) 

This concludes the first layer of randomization. 

2. Backtracking to section 2, by equation H22J1 . choosing the {ukm} ke.[K'],me[n'] a ^ random 
according to p' ', followed by expurgation, results in failure with probability e+10^/e, thus modifying 
the fidelity estimate Ij61|l to 1 — lO-^^e — Q^/e — 3e. This is the second layer of randomization. The 
average code density matrix before the expurgation is (denoting by E the expectation value over 
the {u fcm }) 



E 



— r 

k'u' ^— ' 



\<i>km) (fan 



for which 



(fe,m)G[K']x[/j'] 

||^y( a: ")|^)(0 xn |-^"||<2e. 
The expurgation itself has a small effect on the average code density operator: 



1 

Kfl 



y \fam)(fa r, 

(fc,m)e[/«]x[/i] 



1 

k'/j,' 



E 



\<t>km) (fan 



(fe,m)£[«']x 



implying 



E 



1 

KjjL 



y \fam)(fa 
(k,m)e[n]x \p] 



E 



K'fl' 



E 

(fc,m)g[re'] x [/*'] 



\fam)(fari 
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E 



p—E 



and hence 

— y2 \<pkm){<f>k 

KLL * — ' 

(k,m)e[K]x[fi] 

By (GO). 

— \^km){4>k 

where ~p := Ep is the average code density matrix of our doubly randomized protocol. Hence 

\W~P® n \\ <4<Te + 2V~e + 2e, 

which concludes the argument. 



< 4^/i+2e. 



< 2JI. 
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